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Abstract. Let E be an elliptic curve over Q without complex multiplication, 
and which is not isogenous to a curve with non-trivial rational torsion. For each 
prime p of good reduction, let |_E(F P )| be the order of the group of points of the 
reduced curve over F p . We prove in this paper that, under the GRH, there are at 
least 2.778C^ vm £/(log2;) 2 primes p such that |-E(F p )| has at most 8 prime factors, 
counted with multiplicity. This improves previous results of Stcuding & Weng 
[IB] and Murty & Miri [13]. This is also the first result where the dependence on 
the conjectural constant C^" 11 appearing in the twin prime conjecture for elliptic 
curves (also known as Koblitz's conjecture) is made explicit. This is achieved by 
sieving a slightly different sequence than the one of [18] and [13]. By sieving the 
same sequence and using Selberg's linear sieve, we can also improve the constant 
of Zywina 22J appearing in the upper bound for the number of primes p such that 
|£?(Fp)| is prime. Finally, we remark that our results still hold under an hypothesis 
weaker than the GRH. 



1. Introduction 

The twin prime conjecture is one of the oldest questions in number theory, and 
can be stated as: there is an infinity of prime numbers p such that p + 2 is also 
prime. The best known result is due to Chen [3], who proved that 

(1.1) \{p^x:p + 2 = P 2 }\ ^ 0.335-^4 

for x ^ xq, where P r denotes an integer having at most r prime factors counted with 
multiplicity and 



Ctwm: " 2 n( 1_ FiF) 



e>2 

Here and in the sequel, the letters p and i denote prime numbers. There are many 
generalisations of the twin prime conjecture, and in particular, an analogous con- 
jecture for elliptic curves was formulated by Koblitz [IT]. Let E be an elliptic curve 
defined over Q and denote by E(F P ) the reduction of E modulo p. Koblitz [H] con- 
jectured that if E is not Q-isogenous to an elliptic curve with non-trivial Q-torsion 
subgroup then 

(1.2) in (x) := \{p < x : \E(¥ P )\ is prime}| ~ 
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with a non-zero constant Cj^ 111 as x — > oo, where the constant C^ 111 can be defined as 
an Euler product as the twin prime constant C tw i n - It will be described explicitly in 
Section [2J This conjecture has theoretical relevance to elliptic curve cryptosystems 
based the discrete logarithm problem in the group E(¥ p ). 

As the twin prime conjecture, Koblitz's conjecture is still open, but was shown to 
be true on average over all elliptic curves [2]. One can also apply sieve methods to 
get lower bounds for the number of primes p such that |£/(F P )| is almost-prime. It 
is necessary to distinguish two cases: when E has complex multiplication (CM) or 
not. In the first case, Iwaniec & Jimenez Urroz [9], [10] have obtained an analogue 
of Chen's theorem (11.11) . In the non-CM case, all results assume the generalized 
Riemann hypothesis (GRH) for Dedekind zeta-f unctions of some number fields. The 
first result of this type is due to Miri & Murty [13], who proved by using Selberg's 
sieve [T] that 

(1-3) \{p < x : \E(¥ p )\ = P 16 }| » -^— 2 

1 1 ' 1 (logo;) 2 

for x ^ xq(E), where the implicit constant depends on the elliptic curve E. Re- 
cently Steuding and Weng [18j have improved 16 to 9, by using Richert's logarithmic 
weighted sieve [7] and some improvements to the error term of the explicit Cheb- 
otarev Density Theorem due to Serre [16] and M.-R. Murty, V.-K. Murty & Saradha 



We prove in this paper a better result under a weaker hypothesis, namely we 
replace the GRH by the ^-hypothesis which states that there are no zeroes with 
3?e s > 9 for Dedekind zeta-functions and Artin L-functions. This is stated in 
Section [3] as Hypothesis 13.41 We also write explicitly the constant in terms of the 
twin prime constant C^ 111 by modifying slightly the set to sieve. 

Theorem 1.1. Let E be an elliptic curve over Q without complex multiplication 
which is not Q-isogenous to an elliptic curve with non-trivial Q-torsion. Assuming 
Hypothesis \3.4\ for any 1/2 ^ 9 < 1, we have 

(1.4) \{p^x:(\E(¥ p )\,M E ) = l, \E(¥ p )\ = P r }\ > f t^R * 

1 k ' 1 1 — 9 [iQ'gxY 

for x ^ xq(E), where Me is an integer depending on E (which will be described 
explicitly in Section^) and 

18 + 29' 



(1.5) r = r{9) := — — — 1. 

Here [t] denotes the integral part oft. 

Since (18 + 29) /(5 — 59) < 8 if and only if 9 < 11/21, we immediately obtain the 
following result, which improves, under a weaker hypothesis, the result of Steuding 
Sz Weng mentioned above. 

Corollary 1.2. Let E be an elliptic curve over Q without complex multiplication 
which is not Q-isogenous to an elliptic curve with non-trivial Q-torsion. Assuming 
Hypothesis \3.4\ for any 1/2 ^ 9 < 11/21, we have 

/'"-'twin™ 

(1.6) \{p^x:(\E(W p )\,M E ) = l, \E(¥ p )\=P 8 }\ ^ 2.778 
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for x ^ Xq(E). In particular U.6]) holds if we assume GRH. 

Of course, Theorem 11.11 and Corollary 11.21 imply the same lower bound for 

\{p^x : \E(¥ P )\ = P S }\ 

since we are getting a lower bound for a smaller set. We will see in Section [2] that 
it is natural to count primes such that (\E(¥ p )\, Me) = 1 when sieving to get the 
right constant in Theorem ll.il 

Upper bounds for 7r^ vm (a;) were first studied by Cojocaru who showed in [1] that 
7r^ m (x) <C x/(logx) 2 by using Selberg's linear sieve under the GRH. The implicit 
constant depends on the conductor of E, but the exact dependency was not worked 
out. Very recently, Zywina [22] applied an abstract form the large sieve to obtain 
that 

/'"-(twin™ 

(1-7) < in (x)^{22 + o(l)}-^ 

(logxj z 

as x — > oo. His result applies to a more general form of Koblitz's conjecture, where 
the elliptic curve E can be defined over any number field, and can have rational 
torsion on an isogenous curve. 

The second aim of this paper is to show that Selberg's linear sieve allows us to 
obtain the correct twin prime constant C^ 111 with a better constant factor than (II. 7p 
in the case of elliptic curves over Q with no rational torsion. 

Theorem 1.3. Under the condition of Theorem \l.l\ for any e > we have 

/^(twin™ 

O HI X 



vr* win fx) < 



(logx] 



2 



for x ^ x (E, e) 



Then, assuming GRH, Theorem 11.31 allows us to improve the constant in (11. 7p 
from 22 to 10. 

Acknowledgments. The second author wishes to thank lTnstitut Elie Cartan de 
Nancy-Universite for hospitality and support during the preparation of this article. 



2. Koblitz's Conjecture 

Let E be an elliptic curve over Q without complex multiplication with conductor 
Ne, and let L n := Q(E[n]) be the field extension obtained from Q by adding the 
coordinates of the points of n-torsion to Q. This is a Galois extension of Q, and in 
all this paper, we denote 

G(n) = Gal(L„/Q). 

Since E[n](Q) ~ Z/nZ x Z/nZ, choosing a basis for the ri-torsion and looking 
at the action of the Galois automorphisms on the n-torsion, we get an injective 
homomorphism 

p n : G{n) ^ GL 2 (Z/nZ). 

If p \ uNe, then p is unramified in L n /Q. Let p be an unramified prime, and let 
cr p be the Artin symbol of L n /Q at the prime p. For such a prime p, Pn(<T p ) is 
a conjugacy class of matrices of GL 2 (Z/r?,Z). Since the Frobenius endomorphism 



4 C. DAVID & J. WU 

(x, y) t— ¥ (x p , y p ) of E over ¥ p satisfies the polynomial x 2 — a p x + p where a p is 
defined by the relation 

(2.1) \E{¥ P )\ = p + 1 - a p , 
it is not difficult to see that 

tr(p n (<7p)) = a p (modn) and det(p n (a p )) = p (modn). 

It was shown by Serre [TB] that the image of the Galois representations p n are as 
big as possible, and there exists a positive integer M E such that 

(2.2) If (n, M s ) = 1, then G(n) = GL 2 (Z/nZ); 

(2.3) If (n, M E ) = (n, m) = 1, then G(mn) ~ G(m) x G{n). 

For any integer n, let 

G(n) = {g G G(n) : det{g) + 1 - tr(g) = (modn)} . 

The original Koblitz constant was defined in terms of the local probabilities for the 
event £ \ p+l — a p (E), which can be evaluated by counting matrices g in GL 2 (Z/£Z). 
More precisely, for each prime £, the correcting probability factor is the quotient 

(2.4, E(f) = '-iccoywi 

where the numerator is the probability that p + 1 — a p (E) is not divisible by £ and 
the denominator is the probability that a random integer is not divisible by I. If 
G(£) = GL 2 (Z/£Z), which happens for all but finitely many primes by ( 12. 2ft . then 

£(g) _ l-lC(l)l/[G(l)l = x p 2 — p — i 



The constant G^ 111 of [UJ was defined as the product over all primes £ of the Eu- 
ler factors E(£). In [2T], Zywina made the observation that the probabilities are 
not multiplicative, as the events are not independent: the fields Q(i?[£]) are never 
disjoint for all primes £, as observed by Serre in [T5]. For any integer m, let 



J2(m) = {g e G(m) : (det(g) + 1 - tr(#), m) ^ 1} . 
According to the refinement of [21J, the probability factor at Me is defined as 

l-\n(M E )\/\G(M E )\ 

rw 1 - 1 /^) ' 

The twin prime constant G^ m is then defined as 

1-\Q(M E )\/\G(M E )\ yj / £ 2 -£-l 



( } * rw 1 - m ill (^-i) 3 (^+i) 



We also remark that if we assume Koblitz's conjecture, it follows immediately that 

w E <^ 

(log a;) 2 



;2.6) |{p^x:(|E(F p )|,M £ ) = l, |£(F p )| is prime} | 



ALMOST PRIME VALUES OF THE ORDER OF ELLIPTIC CURVES 



5 



as x — > oo. It is easy to see that (11.21) and (12.61) are equivalent, as we can write 

(2-7) E i= E i+ E i- 

p^x 

|-E(F P )| is prime |E(F P )| is prime |E(F P )| is prime 

(\E(¥ p )\,Me)=1 (\E(¥ p )\,Me)>1 

The condition that \E(¥ P ) \ is prime and (\E(¥ P )\,M E ) > 1 implies that \E(¥ P ) \ = p' 
for some prime p' which divides Me- On the other hand, the relation (12.11) and 
Hasse's bound \a p \ ^ 2^/p allow us to deduce that |_E(F P )| ^ p + 1 — 2 v /p ^ p/16. 
Thus p ^ 16p' ^ 16Mg. This shows that the second sum on the right-hand side of 
f l2T7j) is bounded by 16Mb. 

In this paper, we sieve the sequence 

(2.8) {\E(W p )\ :p^x, (\E(¥ p )lM E ) = l} 
instead of the sequence 

(2.9) {\E(¥ p )\:p^x} 

suggested by ( 11. 2ft as in [TH [TBI EE] . This will allow us to obtain the correct twin 
prime constant C E vm in our theorem. 
We will need later the fact that 

This can be proven by using the Chebotarev Density Theorem in the extension 
Lm e /Q- We are using here only the density result of the Chebotarev Density 
Theorem, and we refer the reader to Section [3] for versions of the Cheboratev 
Density Theorem with an explicit error term that will be needed to perform the 
sieve. Since 1 — \Q(Me)\/\G(Me)\ is the proportion of matrices in g e G(Me) with 
(det g + 1 — tr g, Me) = 1, we have that 



/ _ \(l(M E )\ \ y 



(\E(Vp)lM B )=l 

E^) E 1 

d\M E P^ x 

d\\E(¥ p )\ 



\C(d)\ 



7r(x) E M 



as x — > oo. 



3. Chebotarev Density Theorem 

We write in this section an explicit Chebotarev Density Theorem associated with 
the Galois extensions of Q obtained by adding the coordinates of the points of 
n-torsion to Q. 

We first need some notation and definitions. In all this section, let L/K be a 
finite Galois extension of number fields with Galois group G, and let C be a union 
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of conjucacy classes in G. Let tik and n L be the degrees of K and L over Q, and 
d K and d L their absolute discriminant. Let 

M{L/K) :=\G\4 nK X[p, 

v 

where the product is over the rational primes p which lie below the ramified primes 
of L/K. Let ttc(x, L/K) be the number of prime ideals p £ K such that Np ^ x 
which are unramified in L/K and with a p £ C, where a p is the Artin symbol at the 
prime ideal p. 

The following Theorem is an effective version of the Chebotarev Density Theorem 
due to Lagarias and Odlyzko [12], with a slight refinement due to Serre [16] . 

Theorem 3.1 (Effective Chebotarev Density Theorem), (i) Let ft be the exceptional 
zero of the Dedekind zeta function of L (if any). Then, for all x such that \ogx ^> 
n L (log d L ) 2 , 

7r c (x,L/K) = M Li (x) + O (pLi(^) + \C\xexp {-cn^ 2 log 1 / 2 xfj , 

where c is a positive absolute constant, and \C\ is the number of conjugacy classes 
in C . 

(ii) Assuming the GRH for the Dedekind zeta function of the number field L, we 
have that 

7c c (x,L/K) = \^U(x)+0(x 1/2 \C\n K log (M(L/K)x)) . 

We now apply Theorem 13.11 to the torsion fields of elliptic curves. 

Theorem 3.2. Let E be an elliptic curve over Q without complex multiplication, 
and let L n , C{n) and G{n) be as defined above. Assuming the GRH for the Dedekind 
zeta function of the number fields L n , we have that 

(i) Let d be a square-free integer such that (d, Me) = 1. Then, 

( f _ 2 \ 
n _ !)^2 - 1) ) Li(x) + ^ v/2 iog t dNEX ">) ■ 

(ii) Let I be a prime such that I \ Me- Then, 

n c(n (x,L e2 /Q) = *!£^L* Li(a;) + O (fx l / 2 \og(£N E x)) . 



It was noticed by Serre jT£j that one can improve significantly the error term of 
Theorem I3.11 (ii) (basically replacing |C| with IC) 1 / 2 ) by writing the characteristic 
functions of the conjucacy classes C in terms of the irreducible characters of G, and 
then working with the Artin's L-functions associated with those characters. Further 
applications can be found in [H], [5] and in [18] for the present application. For the 
convenience of the reader, we summarize in the next two theorems the main features 
of the approach, and how it can be applied in our case. 

We first define some notation. For each character \ of G, let L(s, x) be the Artin 
L-function associated to \- If G is an abelian group, the Artin L-functions of L/K 



ALMOST PRIME VALUES OF THE ORDER OF ELLIPTIC CURVES 7 

corresponds to Hecke L-functions, and are then analytic functions of the complex 
plane. In general, we have 

Conjecture 3.3 (Artin's conjecture). Let x be an irreducible non-trivial character 
of G. Then, L(s, x) is analytic in the whole complex plane. 

We will write the improvement of Theorem 13.11 under the ^-hypothesis for the 
zeros of the L-functions in the critical strip, where 1/2 ^ 9 < 1, and not the full 
Riemann Hypothesis, which allows us to obtain an improvement of the results of 
[18] under a weaker hypothesis. 



Hypothesis 3.4 (^-hypothesis). Let L(s) be a Dedekind zeta function, or an Artin 
L-function satisfying Artin's conjecture. Let 1/2 ^ 9 < 1. Then L(s) is non-zero 
for Vies > 9. 

Let if be a class function on G, i.e. a function which is invariant under conjugation. 
Define 

n v {x,L/K) := ^ f( a p)- 

Np^x 
p unramificd 

If C is a conjugacy class (or a union of conjugacy classes) in G, and lc is its 
characteristic function, then n lc (x, Lj K) = n c (x, L/ K) as defined above. 

To define fr^x, L/K), we need to extend the definition of the Artin symbol a p at 
the ramified primes p. This is done in [TH1 Section 2.5], and we refer the reader to 
this paper. Then, 

•L/K)= -^«)' 

< ' m 



TT<p[X, 



. m 

Np m 



where the sum runs over all pairs of primes p of K and integers m ^ 1 such that 
Np m ^ x. With this definition, if tp — x is a character of G and L(s, x) is the Artin 
L-function of x with 



logL(s,x) = Yan(x)i 



.. . J" 

n=l 

then 



tt x (x,L/K) = ^2a n (x). 

n^x 

Then, 7r v (x, L/K) has the following two important properties. 
Lemma 3.5. [161 Propostion 7] Under the previous notation, we have 

n v (x,L/K) = 7r,p(x, L/K) + O ^sup \<p(g)\ ^-^-logd L + n K x 1/2 ^ . 

Lemma 3.6. [161 Propostion 8] Let H be a subgroup of G, tpn a class function on 
H and (pc = I n d^(y?#). Then 



71 



[x,L/K)=n VH (x,L/L H ). 



Proof. This follows from the invariance of the Artin L-functions of induced charac- 
ters. □ 

Using lemmas 13.51 and 13.61 we deduce that 
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Theorem 3.7. Let L/K be a Galois extension of number fields with Galois group 
G. Let H be a subgroup of G and C a conjugacy class in G such that C D H 7^ 0. 
Let Ch be the conjucacy class in H generated by C D H . Then 



*c(x,LIK) = L^±L„ Cb (x,L/L") 

Proof. Let be the class function on £? induced from Ch- It is easy to see that 

tp = Ind|(l c J = jfj^ 1 ^ 

and by Lemma [3.61 

7f OH (x I L/L ff ) = MJ^i7ro(x,L/lO. 

Using Lemma [3.51 to bound the difference between 7r and fr, we get the result. □ 

The second piece needed for the improved Chebotarev Density Theorem is an 
estimate for 7To(x, L/K) in the case that G has a normal subgroup H with the 
property that the Artin L-functions of G/H satisfy Artin's conjecture and the 6- 
hypothesis. For 9 = 1/2, the following theorem is Proposition 3.12 from 



Theorem 3.8. Let D be a non-empty union of conjugacy classes in G and let H be 
a normal subgroup of G such that for all Artin L-functions attached to characters of 
G/H ~ Gal(L /K), the Artin conjecture and the 9-hypothesis hold. Suppose also 
that HD CD. Then, 

n D (x,L/K) = ^U(x)+o(0^\ ' x e n K \og(M{L/K)x)\ 

We now apply the last two theorems to get an improvement to Theorem 13.21 Let 
E be an elliptic curve without complex multiplication, let t \ Me, and let Lg/Q, 
G(£) and C(t) be as defined above. Let B(£) C G(£) be the subgroup of Borel 
matrices. Let Cb(£) be the union of conjugacy classes generated by B(£) H C(£). 
Applying Theorem 13 .7\ we get 

(3.1) 7r cm (x, L t /Q) = icjffll ^) L £ /L™) + O (Hog (£N E ) + £x^) 

using the bounds of [T6], Section 1.4] for logc^. 

Let U{£) C B{£) be the subgroup of unipotent matrices. It is easy to see that U(£) 
is a normal subgroup of B(£), and that B(£)/U(£) is the abelian group of diagonal 
matrices over F^. Artin's conjecture then holds for all L-functions of L^ / Lf , 
and we apply Theorem 13.81 with G = B(£), H = U(£) and D = Cb{£) under the 
^-hypothesis for the appropriate L-functions. This gives 

(3.2) n CB(e) (x, L t /Lf l) ) = + O {£ 3/2 x e log (£N E x)) . 

We are now ready to state the improvement to Theorem l3.2l In the next theorem, 
all error terms depend on the elliptic curve E. We remark that we need a version 
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of the Cheboratev Density Theorem in the extension L n where n is not necessarily 
co-prime to Me in order to sieve the sequence of (12.81) . 

Theorem 3.9. Let E be an elliptic curve overQ without complex multiplication. As- 
suming the 8-hypothesis for the Dedekind zeta functions of the number fields L n /Q, 
we have 

(i) Let d,m be a square-free integers such that (d, Me) = 1 and m \ Me- Then, 

7r c(dm) (x, WQ) = (n ("/-I) ) Li(x) + ° E ( d3/V bg (cfa) ) • 

(ii) Let £ be a prime such that £ \ Me- Then, 

TT C(e2) (x,L e2 /Q) = —^A^l-Li(x) +O e (£ 3 x e \og(£x)) . 

Proof. The proof of (i) with d = £ and m = 1 follows directly by replacing (13.21) in 
( 13. II) . and the general case of (i) follows by applying the same reasoning as above to 
the extension Ldm/Q with Galois group G(dm) ~ G{m) x Yli\d GL 2 (F^). The proof 
of (ii) follows similarly using G{£ 2 ) ~ GL 2 (Z/£ 2 Z). □ 



4. Greaves' weighted sieve and proof of Theorem 11.11 

We first recall the simplified version of Greaves' weighted sieve of dimension 1, 
i.e. taking E = V and T = U in [8j Theorem A]. 

Let A be a finite sequence of integers and V a set of prime numbers. Let B = B(V) 
denote the set of all positive square-free integers supported on the primes of V . For 
each d G B, define 

Ad '■= {a G A : a = (modcT)}. 

We assume that A is well distributed over arithmetic progressions (mod d) in the 
following sense: There are a convenient approximation X to |^4| and a multiplicative 
function w(d) on B verifying 

(A ) ^ w(p) <p (p G V) 

such that 

(i) the "remainders" 

(4.1) r(A, d) := \A d \ - (d G B) 
are small on a average over the divisors d of 

(4.2) P(z):= J] p; 

p<z,peV 

(ii) there exists a constant A ^ 1 such that 



\ — — logp - log — 

per 



^ A (2 ^ zi ^ z 2 ) 
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Let U and V be two constants verifying 

(4.3) V ^V^±, § < Z7 < 1, U + 3V^1, 

where Vq := 0.074368 • • • . The simplified version of Greaves' weighted sieve function 
is given by 

(4.4) H(A, D V ,D U ) := ^((a,P(D u ))), 

aeA 

where D ^ 2 is the basic parameter of considered problem, 



n 



{i- J2 ^-nv))} 



p\n,p£V 



with ({a;} + := max{0, x}), and 

1 / logp 



- V ] if Z> v < p < 



otherwise. 



It is clear that 

H(A,D V ,D U )= &{(a,P(D U ))) 



aeA 

(a,P(D v ))=l 



> E {i- E (i-'M)} 



(a,F(I^))=l 



E ' E ^ 



U-V v ^> jr V UlogD 

(a,P(D v ))=l p | a 

The last quantity is the sum of weights of Richert's logarithmic weighted sieve [H 
Chapter 9, (1.2)]. Therefore, Greaves' weighted sieve is always better than Richert's 
sieve. It is worth pointing out that Richert's logarithmic weighted sieve would have 
been sufficient for our propose. In fact, for our choice of parameters, these two 
sieves coincide in the main term (comparing [TJ Lemma 9.1] and f|4.12p below). The 
greatest advantage of Greaves' weighted sieve is the bilinear form error term. In 
many applications (for example P2 in short intervals, [20]), this advantage allows to 
take a larger level of distribution D to obtain better results. The actual version of 
Chebotarev Density Theorem does not allows us to profit of this advantage for our 
problem. 

As usual, let Q(n) and u)(n) denote the number of prime factors of n counted with 
and without multiplicity, respectively. Define 



u(a, z) :— u(a) + 1, 



pT\a 

where the sum is taken over all pairs of primes p ^ z and integers v ^ 2 such that 
p u divides a. 
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The function H will be used to detect the integers in A having few of prime factors 
in the following way. 

Lemma 4.1. Let E be an elliptic curve over Q and let 

S* := {\E(¥ p )\ :p^x, (\E(¥ p )\,M E ) = 1}, 
& := {p :p\M E }. 

If there are real positive constants U, V, £, xq(E), B and positive integer r such that 
lji4-3\ ) holds and for x ^ xq(E), 



(4.5) maxa^D rU+v 

(4.6) K 2 I<£ 



D v ^p<D u 



(logs) 



(4.7) H(^,D V ,D U )^B^^, 
where D := x^ , then we have 

(4.8) \{p < x : (\E(¥ P )\,M E ) = 1, Q(\E(¥ P )\) < r}| ^ {B + o{l)}-^— 
1 1 J 1 (logxj^ 

/or a; ^ Xq(E). 

Proof. Since ^ 1, we have ^ &(n) Si 1 for all n£N. Thus hypothesis (14. 7p 

allows us to write 



E ^ E 



(a,P(.D v '))=l,^((a,P(D ,7 )))>0 (a,P(D y ))=l 



(4-9) = H(jrf,D v ,D u ) 



(logs) 



for x ^ So(-E'). 

For each a & £/ counted in the sum on the left-hand side of (14.91) . we have 
(a,P(D v j) = 1 and 



o<{i- e i 1 -^))} 



p\a, p<D u 

1 



logp 

U-V ^ V ~ fogD 

p\a,p<D u v 
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This and hypothesis (14.51) imply 



o<u-v- V (u-£*£) 

^ V log D J 

p\a,p<D u V 67 



P|a ' ~ P^D U , u^2, p v \a 

-V -Uu(a,D u ) + 



log£> 

^ ?7 - V - fA^a, Z^) + rC/ + V 

= U(r + l-uo(a,D u )). 

Hence for such a we have (a, P(D V )) = 1 and u(a,D u ) ^ r. Combining this with 
( 1491) . we obtain 



{p^x: (\E(¥ p )\,Me) = (\E(¥ P )\,P(D V )) = 1, w(|£(F p )|, D") < r}| 



(4.10) ^ ^C^x 



(logx) 2 

When ( \E(¥ P ) |, P(£> y )) = 1, we have u(\E(¥ p )\,D u ) = Q(\E(¥ P )\) unless a is 
divisible by the square of a prime p such that -D y ^ p < D u and the required result 
L"8]) now follows from (14.101) and hypothesis (14.61) . □ 

Now we are ready to prove Theorem 11.11 
In Lemma 14.11 take 



r = r(9) :- 



18 + 26 
5(1-9) 



where e is an arbitrary small positive number. It is easy to see that condition ( 14.3H 
is satisfied. In order to verify (14. 5p . it is sufficient to show that £(rU + V) > 1, since 
a p satisfies Hasse's bound \a p \ < 2^/p. In view of the fact that e is arbitrarily small, 
we have 

, f rr T r\ 2(1-0)., .((18 + 29 8 \5 1\ 1 

It remains to verify ( 14. 6ft and (14. 7ft . 

First Theorem I3.9( ii) allows us to deduce 

E k»i« E (^ + p Vl0 ^) 

«/r^ + J D 4C V 
« s 1 -*^ 

for all a; ^ 3. This shows that (14. 6p is satisfied. 
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For d square- free with (d, M E ) = 1, we can write 



E 1 

(\E(¥ P )IM E )=1 
|£(F p )|=0(mod d) 

Y ^( m ) Y 1 

m\M E p^x 

\E(¥ p )\=0(mod d) 
|S(F p )|=0(mod m) 

Y ^( m ) S 1 

m|M B p^x 

|£(F p )j=0(mod dm) 

Y Viscid in) -^drn 
m\M E 



Using Theorem I3.9f i) and (I2.10p . we get that 
W d \ = Li(x 



lC(d)l Y Krn)^ + E (\C(d)\^lo g (dx)) 



E 



Thus we obtain 

(4.11) \^ d \ = ^-X + r(^,d) 

for all deB(&), with 

d\C{d)\ yr £(f-2) 

W[d) \G(d)\ 11 (*-!)(*-!) 



and 

\VL(M E 



X : I 1 \G(M B 
Since 

w{£) = 1 + 



-^Li(x), \r(^,d)\ < B d 3/ Vlog(cfe). 



(£-l)(P-iy 



conditions (A ) and (fli) are satisfied. Thus Theorem A of [8] is applicable. Denoting 
by 7 the Euler constant and defining 



V(D) := J] (l 

•n^- n \ 



p<D 

p€,9> 



V 
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Theorem A of [8] allows us to write 



(4.12) + a(V)-V\o g 3- Vf3(V) + y^^yJE 



(logD) 1 / 3 ! ^ ^a m /3 n r(^, 



mn 



m<M n<N 
mn\P(D u ) 

where M and iV are any two real numbers satisfying 

M > I)' . N > 1, MiV = d 

and a m , j3 n are certain real numbers satisfying \a m \ ^ 1, |/3 n | ^ 1. The functions 
a(V) and /3(V) are given by 

, 1-1/ /' 1/y /2 1 , . , 1 - logfw - 3) , 

w : . log i_Z _ f ( log(2 _ + log Izlhi) ^ dM , 

for | ^ y ^ \. 

By using the prime number theorem, it follows that 

nH)n(.-»)H)-' 



(4.13) 



^^in(i--V'n(i- f2 ~'~ 1 

as D — > oo. 

On the other hand, denoting by the Mobius function, Theorem l3.9( ii) implies 
that 



| ^oi m (3 n r{srf,rnn)\ ^ 2 yu(rf) 2 3" ((i) d 3/ V log(dx) 

m<M ra<iV a!^D 
(4.14) m " |P(D " ) <<; xejD 5/2 +£ (l- e) /2 



since 



D = x^ with£ = |(l-0)(l-e). 
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Combining (Q2|l . ffl~13D . fITOj) and (1231) . we can find that 
with 

a( V) - V/3(V) - Vlog 3 - U log C/ - (1 - U) log(l - 17) - log(4/3) 



iiU-V) 



Since J(£, [/, V) is continuous in (£, [/) and = /3(|) = 0, a simple numerical 
computation shows that 

2J^,U,V)=2j(^l, | \)+0(e) 
1.32304- •• ^. . 

= ^T^- + °( £ )- 

This implies 

v 7 1 — (logs) 2 

for x ^ Xq(E). This completes the proof of Theorem 1 1.11 □ 

5. Selberg's linear sieve and proof of Theorem 11.31 
We use the notation of Section HI As usual, we write the sieve function 

S(£?, z) := \{a e srf : p \ a and p G 8? => p > z}\. 

Then in view of ( 12.7ft . we can write the following trivial inequality 

(5.1) n%' m (x) ^ S(s/, &>, D 1/2 ) + 0(D 1/2 ) 

for all x ^ 1, where D = x^ with £ = 2(1 — 0){1 — e)/5 as before, and the O-constant 
depends on the curve i£. 

Using Selberg's linear sieve [71 Theorem 8.3] with q — 1, it follows that 



where 



S« J7 1/2 ) ^ IV(D 1/2 ){F(2) + o(l)} + . 



3 w W|r(^,d)| 



< ^/i(rf) 2 3" (d) d 3/ Vlog(d, 

,l-e(l-e)/2 



< a; 1 



using Theorem I3.9( i). 
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Since F(2) = e 7 , replacing D by D 1 ^ 2 in the asymptotic formula (14.131) . we get 
that 

XV(D 1 ' 2 )F(2) = C* win ^M {i + (i)\ 

log a> 



c \ /"(twin ™ 



1 — / (log a;) 



for x ^ Xq(E, e). 

Combining these estimates, we find that 



(5.2) S{^,&,D 1 ' 2 )^ 1^ + ^ 



5 \ C^ m x 



(logx) 2 

for x is Xq(E,£). Theorem 11.31 now follows from (15. ip and (15.21) . □ 



References 

[1] E. Bombieri, Le grand crible dans la theorie analytique des nombres, Asterisque 18 (1987), 
2nd edition, 103pp. 

[2] A. Balog, A. C. Cojocaru & C. David, Average twin prime conjecture for elliptic curves, 

preprint. larXiv:0709.146H 
[3] J.-R. Chen, On the representation of a large even integer as the sum of a prime and the 

product of at most two primes, Sci. Sinica 16 (1973), 157-176. 
[4] A. C. Cojocaru, Reductions of an elliptic curve with almost prime orders, Acta Arith. 119 

(2005), no. 3, 265-289. 

[5] A. C. Cojocaru & C. David, Frobenius fields for Elliptic Curves, American J. of Math. 130 

(2008), no. 6, 1535-1560. 
[6] F. Grupp & H.-E. Richcrt, The functions of linear sieve, J. Number Theory 22 (1986), no. 

2, 208-239. 

[7] H. Halberstam & H.-E. Richert, Sieve Methods, Academic Press, London 1974. 

[8] H. Halberstam & H.-E. Richert, A weighted sieve of Greaves' type, II, in: Elementary and 

Analytic Theory of Numbers, Banach Center Publication 171 (1985), 183-215. 
[9] H. Iwanicc & J. Jimenez Urroz, Orders of CM elliptic curves modulo p with at most two 

primes, preprint. 

[10] J. Jimenez Urroz, Almost Prime Orders of CM Elliptic Curves Modulo p, in: Lecture Notes 
in Computer Science 5011, Springer (2008), 74-87. 

[11] N. Koblitz, Primality of the number of points on an elliptic curve over a finite field, Pacific 
J. Math. 131 (1988), No. 1, 157-165. 

[12] J. Lagarias & A. Odlyzko, Effective versions of the Chebotarev Density Theorem, in: Alge- 
braic Number Fields (A. Frohlich edit.), New York, Academic Press (1977), 409-464. 

[13] S.-A. Miri & V.-K. Murty, An application of sieve methods to elliptic curves, in: Progress in 
cryptology— INDOCRYPT 2001 (Chennai), Lecture Notes in Comput. Sci. 2247, Springer 
(2001), 91-98. 

[14] M.-R. Murty, V.-K. Murty & N. Saradha, Modular forms and the Chebotarev density theorem, 

Amer. J. Math. 110 (1988), 253-281. 
[15] J. -P. Serre, Proprietes galoisiennes des points d'ordre fini des courbes elliptiques, Invent. 

Math. 15 (1972), 259-331. 
[16] J.-P. Serre, Quelques applications du theoreme de densite de Chebotarev, Inst. Hautes Etudes 

Sci. Publ. Math. 54 (1981), 323-401. 
[17] H. M. Stark, Some effective cases of the Brauer-Siegel theorem, Invent. Math. 23 (1974), 

135-152. 



ALMOST PRIME VALUES OF THE ORDER OF ELLIPTIC CURVES 



17 



[18] J. Steuding & A. Weng, On the number of prime divisors of the order of elliptic modulo p, 

Acta Arith. 117 (2005), no. 4, 341-352. 
[19] J. Steuding & A. Weng, Erratum: "On the number of prime divisors of the order of elliptic 

curves modulo p" [Acta Arith. 117 (2005), no. 4, 341-352; MR2140162], Acta Arith. 119 

(2005), no. 4, 407-408. 

[20] J. Wu, P 2 dans les petits intervalles, in : Seminaire de Theorie des nombres, Paris 1989-1990 

(D. Sinnou Ed.), Progress in Math. 102, Birkhiiuser (1992), 233-267. 
[21] D. Zywina, A refinement of Koblitz's conjecture, preprint. 

[22] D. Zywina, The large sieve and Galois representations, preprint. arXiv:0812.2222. 

Department of Mathematics and Statistics, Concordia University, 1455 de Mai- 
sonneuve West, Montreal, QC, H3G 1M8, Canada 
E-mail address: cdavidOmathstat . concordia . ca 

Institut Elie Cartan Nancy (IECN), Nancy-Universite, CNRS, INRIA, Boulevard 
des Aiguillettes, B.P. 239, 54506 Vandceuvre-les-Nancy, France 
E-mail address: wujie@iecn.u-nancy.fr 

School of Mathematical Sciences, Shandong Normal University, Jinan, Shandong 
250100, China 



